github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2024-11-24 04:31:56 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity
101ec21bc9
discourse/spec/requests
History
Alan Guo Xiang Tan 101ec21bc9
SECURITY: Restrict display of topic titles associated with user badges (#18768) 
Before this commit, we did not have guardian checks in place to determine if a
topic's title associated with a user badge should be displayed or not.
This means that the topic title of topics with restricted access
could be leaked to anon and users without access if certain conditions
are met. While we will not specify the conditions required, we have internally
assessed that the odds of meeting such conditions are low.

With this commit, we will now apply a guardian check to ensure that the
current user is able to see a topic before the topic's title is included
in the serialized object of a `UserBadge`.
2022-10-27 11:26:14 +08:00
..
admin DEV: Sidebar default tags and categories are determined at user creation (#18620) 2022-10-27 06:38:50 +08:00
api DEV: Update rubocop (#18754) 2022-10-26 09:05:15 +08:00
about_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
application_controller_spec.rb Revert "Revert "FEATURE: Preload resources via link header (#18475)" (#18511)" (#18531) 2022-10-11 20:11:44 -03:00
associate_accounts_controller_spec.rb DEV: Automatically require 'rails_helper' in all specs (#16077) 2022-03-01 17:50:50 +00:00
badges_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
bookmarks_controller_spec.rb Add RSpec 4 compatibility (#17652) 2022-07-28 10:27:38 +08:00
bootstrap_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
categories_controller_spec.rb FIX: Avoid duplicate topic-list requests (#18073) 2022-08-24 11:54:01 +01:00
clicks_controller_spec.rb Add RSpec 4 compatibility (#17652) 2022-07-28 10:27:38 +08:00
composer_messages_controller_spec.rb FEATURE: add composer warning when user haven't been seen in a long time (#18340) 2022-09-27 22:06:40 +05:30
csp_reports_controller_spec.rb Add RSpec 4 compatibility (#17652) 2022-07-28 10:27:38 +08:00
directory_columns_controller_spec.rb Add RSpec 4 compatibility (#17652) 2022-07-28 10:27:38 +08:00
directory_items_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
do_not_disturb_controller_spec.rb Add RSpec 4 compatibility (#17652) 2022-07-28 10:27:38 +08:00
drafts_controller_spec.rb Add RSpec 4 compatibility (#17652) 2022-07-28 10:27:38 +08:00
email_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
embed_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
exceptions_controller_spec.rb FEATURE: Add page title to 404 pages (#16846) 2022-05-17 18:37:43 +03:00
export_csv_controller_spec.rb Add RSpec 4 compatibility (#17652) 2022-07-28 10:27:38 +08:00
extra_locales_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
finish_installation_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
forums_controller_spec.rb DEV: New readonly mode. Only applies to non-staff (#16243) 2022-05-17 13:06:08 -05:00
groups_controller_spec.rb DEV: Remove remaining hardcoded ids (#18735) 2022-10-25 15:29:09 +08:00
hashtags_controller_spec.rb DEV: Add specs for hashtags related code (#18526) 2022-10-11 09:04:51 +10:00
inline_onebox_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
invites_controller_spec.rb DEV: Add missing assertion for InvitesController test (#18755) 2022-10-26 13:04:55 +01:00
list_controller_spec.rb FIX: Do not show a 404 page when visiting messages (#18652) 2022-10-20 16:24:56 +03:00
metadata_controller_spec.rb DEV: Automatically require 'rails_helper' in all specs (#16077) 2022-03-01 17:50:50 +00:00
notifications_controller_spec.rb DEV: Include pending reviewables in the main tab in the user menu (#18471) 2022-10-05 12:30:02 +03:00
offline_controller_spec.rb Add RSpec 4 compatibility (#17652) 2022-07-28 10:27:38 +08:00
omniauth_callbacks_controller_spec.rb Use service account credentials for fetching google hd groups (#18329) 2022-10-13 16:04:42 +01:00
onebox_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
permalinks_controller_spec.rb Add RSpec 4 compatibility (#17652) 2022-07-28 10:27:38 +08:00
post_action_users_controller_spec.rb Add RSpec 4 compatibility (#17652) 2022-07-28 10:27:38 +08:00
post_actions_controller_spec.rb FEATURE: Introduce personal_message_enabled_groups setting (#18042) 2022-09-26 13:58:40 +10:00
post_readers_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
posts_controller_spec.rb FIX: Exclude hidden topic posts and small actions from the RSS feed. (#18649) 2022-10-18 15:19:54 -03:00
presence_controller_spec.rb Add RSpec 4 compatibility (#17652) 2022-07-28 10:27:38 +08:00
published_pages_controller_spec.rb DEV: Rename secure_media to secure_uploads (#18376) 2022-09-29 09:24:33 +10:00
push_notification_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
qunit_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
reviewable_claimed_topics_controller_spec.rb Add RSpec 4 compatibility (#17652) 2022-07-28 10:27:38 +08:00
reviewables_controller_spec.rb DEV: Do not show handled reviewables in the user menu (#18402) 2022-09-30 06:10:07 +03:00
robots_txt_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
safe_mode_controller_spec.rb DEV: Automatically require 'rails_helper' in all specs (#16077) 2022-03-01 17:50:50 +00:00
search_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
session_controller_spec.rb FIX: Allow email login for admins in staff-writes-only-mode (#18443) 2022-09-30 14:12:49 -05:00
similar_topics_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
site_controller_spec.rb Add RSpec 4 compatibility (#17652) 2022-07-28 10:27:38 +08:00
sitemap_controller_spec.rb Add RSpec 4 compatibility (#17652) 2022-07-28 10:27:38 +08:00
static_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
steps_controller_spec.rb Add RSpec 4 compatibility (#17652) 2022-07-28 10:27:38 +08:00
stylesheets_controller_spec.rb Add RSpec 4 compatibility (#17652) 2022-07-28 10:27:38 +08:00
svg_sprite_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
tag_groups_controller_spec.rb DEV: Automatically require 'rails_helper' in all specs (#16077) 2022-03-01 17:50:50 +00:00
tags_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
theme_javascripts_controller_spec.rb DEV: Include theme_uploads and theme_uploads_local objects in theme tests (#18645) 2022-10-20 08:00:29 +03:00
topics_controller_spec.rb FIX: Remove public topic invite functionality (#18488) 2022-10-10 19:21:51 +03:00
uploads_controller_multisite_spec.rb DEV: Rename secure_media to secure_uploads (#18376) 2022-09-29 09:24:33 +10:00
uploads_controller_spec.rb DEV: Rename secure_media to secure_uploads (#18376) 2022-09-29 09:24:33 +10:00
user_actions_controller_spec.rb Add RSpec 4 compatibility (#17652) 2022-07-28 10:27:38 +08:00
user_api_keys_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
user_avatars_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
user_badges_controller_spec.rb SECURITY: Restrict display of topic titles associated with user badges (#18768) 2022-10-27 11:26:14 +08:00
user_status_controller_spec.rb Add RSpec 4 compatibility (#17652) 2022-07-28 10:27:38 +08:00
users_controller_spec.rb FEATURE: add user status to user preferences (#18532) 2022-10-12 23:35:25 +04:00
users_email_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
webhooks_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
wizard_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00